Short answer: Before an enterprise buyer sends you a security questionnaire, someone in procurement or IT security looks at your website. They want to know who you legally are, where their data would go, what security you can prove, who has bought from you before and roughly what you cost. If your site answers those questions, the questionnaire gets shorter and the deal moves. If it does not, you get a long spreadsheet and a pause. Below are the pages they open, a 10-point checklist, and what a startup without SOC 2 can honestly publish today.
This article is practical guidance for founders, not legal advice. For contracts and compliance decisions, talk to a lawyer or a compliance advisor.
Why buyers check your website before they talk to you
Most of the review happens without you. Gartner reports that “67% of B2B buyers state that they prefer a rep-free experience”. For Europe, 6sense found that buyers pick the vendor “before ever speaking with sales roughly 75% of the time.” Your website is the first document in the file.
There is also a legal reason, in some cases. If you will process their customers’ or employees’ personal data on their behalf, GDPR obliges the buyer, as controller, to “use only processors providing sufficient guarantees to implement appropriate technical and organisational measures” (Article 28(1)), and that processing “shall be governed by a contract or other legal act” (Article 28(3)). That contract is your DPA. If the buyer is an essential or important entity under NIS2, its risk measures must include “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” (Article 21(2)(d)). In other words: if you process their customers’ or employees’ personal data on their behalf, or they fall under NIS2, the law obliges them to check you. The reviewer is not being difficult. They are doing their job.
Large companies formalise this. Microsoft’s supplier program, for example, “covers all suppliers globally that process Personal Data and/or Microsoft Confidential Data”, and “all enrolled suppliers must complete an annual self-attestation of DPR compliance”. You will not meet this at your first customer, but it shows where the bar sits.
Two reviewers, one website
Usually two people look at you, with different questions.
Procurement asks: is this a real company we can contract with? Legal entity, address, registration, who runs it, other customers like us, how pricing works, whether you will still be around in two years.
Security asks: what happens to our data? Hosting location, subprocessors, certifications, policies, incident contact, how you handle vulnerabilities.
Both read the same site. A page written only for marketing (“enterprise-grade security”) helps neither of them. Specific facts help both.
The 10 things they look for
- Legal entity. Full company name, registered address, registration number, VAT ID. In Germany this is a legal duty for business websites: § 5 DDG requires provider details, including legal form, authorised representative, register number and VAT ID, to be “leicht erkennbar und unmittelbar erreichbar” (easy to recognise and directly reachable). Reviewers elsewhere look for the same information.
- A security page or trust center. Certification status, a summary of your policies, and how to request reports under NDA.
- Data location and subprocessors. Where data is hosted, which third parties process it, and how long you keep it.
- DPA and privacy policy. A downloadable DPA, or a clear line on how to request one, plus a current privacy policy.
- A security contact and security.txt. A named address for security issues. RFC 9116 defines security.txt as “a machine-parsable format … to help organizations describe their vulnerability disclosure practices.” It is one small text file.
- Status page and uptime history. Proof that you monitor the product and tell customers when it breaks.
- Case studies. Named customers in comparable industries and sizes, with what you did and what changed.
- Pricing clarity. At least the packaging and how pricing works.
- Who is behind the company. A leadership or team page with real names.
- Consistency. The same claims on the website, in the sales deck and in your questionnaire answers. A reviewer who sees “SOC 2” on the homepage and “in progress” in the questionnaire stops trusting the rest.
If you want to check the rest of the site at the same time, our website redesign checklist covers structure, speed and content.
Trust center or security page?
A trust center is a dedicated hub with security documents, often gated behind an NDA request. A security page is one well-structured page on your site.
At seed stage, a security page is usually enough. Move to a trust center when you have reports to share and security reviews have become a weekly task. Vanta, which sells a trust center product, states that its “Trust Center reduces deal cycles by 30%”. Treat that as a vendor claim about its own product, not an independent result. In the same release, Vanta’s State of Trust 2023 survey of 2,500 IT and business leaders in Australia, France, Germany, the UK and the US found that “two-thirds say that customers, investors and suppliers are increasingly looking for proof of security and compliance.”
If you do not have SOC 2 or ISO 27001 yet
Neither certificate is a legal requirement. They are procurement requirements that buyers set. Vanta writes that “larger buyers have procurement teams that routinely require a SOC 2 report before onboarding a vendor”, that procurement teams “may pause vendor onboarding until a SOC 2 report is on file”, and that Type 2 is, in its words, “the report most enterprise buyers ultimately require”. So plan for it if enterprise is your market. In the meantime, here is what you can publish honestly:
- Status, stated plainly. “We do not hold SOC 2 yet. We started preparing in [month] and expect a Type 1 report by [quarter].” Only publish a date you believe.
- The controls you actually run. For example: SSO and MFA for staff, encryption in transit and at rest, access reviews, backups, logging. List only what is true today.
- Hosting region and provider. Where data lives and whose infrastructure it runs on.
- Subprocessor list. Names, purpose, location.
- DPA. Drafted by a lawyer, downloadable or available on request.
- Security contact and security.txt.
- A pre-filled questionnaire on request. If you have answered one before, offer a cleaned-up version.
What you should never do: show a certification badge you do not hold, write “compliant” without saying with what, or let the deck promise more than the security page.
If you have a certificate, say which one, its scope, the date of the last report and how to request it under NDA. If you are in progress, say which stage you are at.
What European and DACH buyers expect
In EU reviews, three topics deserve extra attention:
- The DPA. Under GDPR Article 28, processing on a controller’s behalf needs a contract. Make it easy to find.
- NIS2 supply-chain questions. If your buyer is an essential or important entity, expect questions about your own suppliers too. Your subprocessor list answers part of that.
- Impressum and data location. German buyers are used to an Impressum on business websites, because § 5 DDG requires these provider details, and they often ask where data is stored. Answer both on the site.
Case studies and pricing: the commercial half of trust
Security answers “can we trust you with data?” Procurement also asks “can we trust you as a supplier?”
Case studies answer that best when they name the customer, the industry and the size, and show a result. One relevant named case beats five anonymous logos.
Pricing matters more than founders expect. In TrustRadius research, “72% of buyers indicated access to transparent pricing made them more likely to purchase a product.” Emily Kramer puts it simply in First Round Review: “Make a packaging and/or pricing page, even if it’s basic. Buyers look for this.” You can still negotiate enterprise terms. What the reviewer needs is to see that a price exists and how it is built. If you are unsure what your current site communicates, the 60-minute brand audit is a quick way to check.
How dp.vision helps, and what we do not do
dp.vision is a senior brand, web and product studio for funded, founder-led B2B tech companies. One team takes you from positioning to brand, website, deck and product, scoped to a milestone in 4-16 weeks, including an enterprise sales push. You work with a strategist and a dedicated team from our 20+ permanent people, through one contact person. We are based in Poznań and work remotely. AI speeds up the work; people make the decisions.
For an enterprise push, we design and write the trust layer of your website: the security page or trust center structure, the legal entity page, case studies and a clear pricing or packaging page, all consistent with your sales deck. We do not run security audits, issue certifications or draft DPAs. For those, work with a compliance platform and legal counsel; we make sure what they produce is easy to find and reads the same everywhere.
Packages: Validate from $2,500, Launch from $9,500, Build from $25,000 (see packages). A website rebuild with trust pages usually fits Launch. For scale, PaceSovereign and DailyMuse are example projects from $40,000 with the full scope: full branding, pitch deck, investor relations support and the product demo and MVP. For a broader view of costs, read how much a website costs.
